Описание
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
A flaw was found in LibVNCServer. A malicious VNC server can exploit an improper bounds checking vulnerability in the UltraZip encoding handler, specifically within the HandleUltraZipBPP() function. By manipulating subrectangle header counts, an attacker can read beyond the allocated memory buffer. This heap out-of-bounds read can lead to information disclosure or cause the application to crash, resulting in a Denial of Service (DoS).
Отчет
The availability impact of this flaw is limited on Red Hat products. While an attacker may be able to induce a crash in the LibVNCServer the host Red Hat system's availability is not at risk. Additionally, unless configured otherwise Red Hat Linux will automatically reboot LibVNCServer in the event of a crash.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libvncserver | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libvncserver | Not affected | ||
| Red Hat Enterprise Linux 8 | libvncserver | Will not fix | ||
| Red Hat Enterprise Linux 9 | gnome-remote-desktop | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer.
LibVNCServer versions 0.9.15 and prior (fixed incommit 009008e) contai ...
5.4 Medium
CVSS3